Security, Belgian GDPR and professional secrecy at the dental front desk
A dental telephone call is health data, so the rules that apply to it in Belgium are stricter than anything on a generic privacy page. Your practice is the controller and Tilcao is the processor, which means an Article 28 processing agreement, the verwerkersovereenkomst or contrat de sous-traitance, has to be signed before the first real patient call, with every sub-processor named in its annex. Calls are recorded, and every caller is told in the first sentence that the call is recorded and that they are speaking to an AI. Tilcao holds no security certification, and this page names the missing ones plainly, because a badge you cannot show is worth less than an honest gap.
Last updated
What patient data does Tilcao touch, and what does it never touch?
Enough to recognise the caller and finish the booking, and deliberately nothing beyond that. Tilcao is not a practice management system and has no ambition to become one. It never writes in the clinical record, never reads a treatment history, and stays entirely out of the national rails Belgium runs through the RIZIV/INAMI, the national health and disability insurance institute, and MyCareNet.
The right-hand column matters more than the left one. Denying a capability is a stronger signal than claiming one, and every line in it is a place where a Belgian practice would otherwise have to take a vendor’s word.
- The national register number (rijksregisternummer / numéro de registre national, the NISS) is redacted at ingestion and is not retained inside a transcript.
- Card numbers and full addresses are redacted the same way.
- A date of birth is stored as a date field, not left sitting inside a retained transcript.
- What is replicated to a dashboard is an appointment type code, not the caller’s account of a complaint. That narrative stays in a separate note with its own access.
- The integration account Tilcao works through holds the narrowest rights that do the job: read the diary, create and move appointments of the configured types, cancel. Nothing else.
| Tilcao processes this | Tilcao never touches this |
|---|---|
| Name, date of birth and contact details, to match a caller to a file | The clinical record. Nothing is written to it and no treatment history is read |
| The appointment itself: type, length, practitioner, date and time | eAttest, eFact and eTarif. Tilcao never attests and never invoices |
| What the caller said they were ringing about, in the caller’s own words | MyCareNet insurability checks and the GMD/DMG. Tilcao holds no eHealth certificate |
| The call audio and its transcript, each on its own retention clock | The eHealthBox and the rest of the eHealth rails. There is no connection to build on |
| A structured summary of what was asked and what was done | Payments. No card details are taken and no transaction is handled |
| The audit record of the call, including who read it afterwards | A diagnosis, an urgency judgement, or a tariff the practice did not give it |
Who is the controller, and what has to be signed before the first call?
The practice is the controller and Tilcao is the processor, the verwerker or sous-traitant, acting only on the practice’s written instructions. That is not a formality to tidy up later. An Article 28 processing agreement has to exist before the first real patient call, and until it does there should be no real patient call.
The legal ground has two layers, because a dental call has two kinds of content. The ordinary part, a name and a time in a diary, rests on Article 6(1)(b) and (f). The health element rests on Article 9(2)(h) for the provision of health care, read with Article 9(3), which requires the processing to happen under the responsibility of a professional bound by professional secrecy or by an equivalent duty of confidentiality. That second clause is the one that decides how Tilcao has to be run internally, and it is dealt with in the next section.
Consent is the wrong ground to lean on, and a vendor who offers it as the answer has not thought about the call. Consent is not freely given when a patient rings in pain and the alternative to agreeing is not getting care. So the disclosure is paired with a real alternative: anyone who would rather speak to a person says so and is handed over, or gets a callback when the practice is closed. Retention of the raw audio is the part a practice can decline without losing the service.
The agreement should be readable by the practice that signs it, not only by a lawyer. These are the clauses to check before signing anything, from Tilcao or from anyone else.
- The subject matter, the duration, and the categories of data and of data subjects.
- The documented instructions, and a commitment to process on nothing else.
- An annex naming every sub-processor, what it does and the region it processes in.
- A retention period per data type, written as a number of days or months.
- The security measures, and how a personal data breach is notified and within what time.
- How the processor helps with access, rectification and erasure requests.
- What happens at the end of the contract: return or deletion, and the evidence of it.
- The right to audit, and what an audit may actually look at.
Gegevensbeschermingsautoriteit / Autorité de protection des données, guidance on sensitive data
How does a recorded call sit with beroepsgeheim and secret professionnel?
Professional secrecy, beroepsgeheim in Dutch and secret professionnel in French, is a separate obligation from the GDPR, it survives the GDPR, and no processing agreement can sign it away. Article 458 of the Strafwetboek / Code pénal binds the dentist and, through the dentist, the people working at the practice. Breaching it is a criminal matter, not an administrative one. So the real question about a recorded call is not whether recording is lawful. It is who can hear the recording, under what duty, and whether that can be proved.
On the recording itself, Belgian law is clearer than most people expect. There is no rule forbidding the recording of a conversation you are party to, and the practice is a party to its own patient calls. Article 314bis §2 of the Strafwetboek / Code pénal punishes the use of a lawfully made recording with fraudulent intent or intent to harm. Telecom rules and the GDPR then apply on top, cumulatively: every participant, the patient included, has to be informed before the recording starts about the recording itself, its precise purpose, and how long it is kept. Tilcao gives all three in the opening sentence rather than burying them in a privacy notice nobody opens.
Inside Tilcao, the Article 9(3) requirement is met by people rather than by a setting. Only those who need a transcript to run the service can read one. Each of them is under a written confidentiality obligation that mirrors medical secrecy, each read is logged against a named account, and the practice can ask for that log at any time. This carries particular weight for francophone practices: the Chambre de Médecine Dentaire names medical secrecy, alongside free choice of practitioner, as one of the two founding principles of the profession it represents.
The practical consequence for a practice owner is simple. If a member of Tilcao staff has read a call from your practice, you can find out that it happened, when, and which account did it.
Where is the data hosted, and how long is it kept?
In the EU and the EEA. No Belgian statute obliges a private dental practice to keep its data inside Belgium; residency duties of that kind bind public bodies, not your practice. But for Article 9 health data in a Belgian clinical setting, EU and EEA processing is the expectation every serious buyer applies, and it is the only defensible commercial position, so it is the commitment.
What this page will not do is promise a blanket EU-only arrangement that a future change of supplier would quietly break. The useful version of the promise is the checkable one: every sub-processor, what it does and the region it processes in, named in the annex to the agreement, with any change recorded as a dated entry rather than a silent edit. The channels run on named third parties today, Retell for voice and the Meta Cloud API for WhatsApp, and they are named in the annex like everything else. Where a component were to process outside the EEA, it would be named there too, with its transfer mechanism, rather than hidden inside a paragraph about global infrastructure.
Retention runs on more than one clock, and the call does not inherit the clock of the clinical file. A dental dossier is kept for years because the law and the care require it. A recording of somebody asking for a Thursday morning is not that, and treating the two the same way is how a practice ends up holding audio it has no reason to hold.
This page prints no retention number, and that is a deliberate gap rather than an oversight. Tilcao is pre-pilot, the periods are set with the practice and written into the agreement, and a number invented for a web page would be the wrong number to be held to. What can be committed to is the shape: a clause that says “as long as necessary” is not a retention clause, and the agreement will carry days and months.
- Call audio: the shortest clock of anything on this list, and the first thing deleted.
- Transcript: kept longer than the audio, because it is what an access request gets answered from.
- Structured summary and appointment fields: kept while the practice needs the operational record.
- Audit record: kept as the accountability evidence under Article 5(2) GDPR. It records that a deletion happened without keeping what was deleted.
- The clinical dossier: the practice’s own retention rules, in the practice’s own system. Nothing on this list touches it.
Who can see what, and what does the audit trail actually record?
Access is per account and per role, and the practice decides who gets which. On the caller side the rule is stricter than most front desks apply by habit: two matching identifiers before anything is read back, typically full name plus date of birth, or name plus postcode. Before that is satisfied, Tilcao does not volunteer the practitioner’s name, the reason for an appointment, any other appointment, or a balance. Third-party requests are refused, with one exception, a parent or guardian asking about a minor.
Accountability under Article 5(2) of the GDPR only means something if it was recorded at the time. Every read of patient data is logged with the caller, the outcome of the verification and the fields that were disclosed. The booking outcome in the summary is derived from what was actually written to the diary, not from what the agent said it would do, so the record and the diary cannot drift apart.
This is what one record looks like. It is worth more than a paragraph of assurances, because a practice can check it against its own diary.
| Field | What the record holds |
|---|---|
| Call | 2026-09-17 19:42, inbound, 3 min 11 s, handled by the Receptionist role |
| Disclosure | AI and recording notice given in the first sentence, in Dutch |
| Identification | Two identifiers matched, surname and date of birth. File 2041 |
| Disclosed | Date and time of the next appointment. Practitioner name withheld until the match |
| Action | Appointment moved, Thursday 10:30 to Friday 11:00, type check-up |
| Written to | The practice diary. The outcome above was read back from the diary |
| Escalation | None. No red flag in the call and no request for a person |
| Read since | Two reads, both by practice staff accounts, each with a timestamp |
How do we pause it, and what happens to a request for erasure?
Any workflow can be paused, and a paused workflow does not run. A blocked action does not happen at all rather than happening and being logged as a problem afterwards. Change a rule and the behaviour changes with it, with no notice period, and the practice can take the whole line back by switching its own call forwarding off. Nothing about stopping is designed to be difficult, because a control you cannot use in the middle of a bad afternoon is not a control.
An erasure request goes to the practice, because the practice is the controller and the patient’s relationship is with the practice. The practice instructs Tilcao, and the audio, the transcript and the structured summary tied to that patient are deleted. The audit trail keeps the fact that a deletion happened, with its date and who asked for it, and not the content that was deleted. Erasure does not reach a record the practice is legally required to keep: the clinical dossier and the accounting trail live under their own rules, in the practice’s own systems, and no request to Tilcao changes that.
A patient may also simply ask what was recorded. The practice answers, as controller, and the GDPR gives it one month, extendable by two months for a genuinely complex request. Tilcao’s job is to put the material in the practice’s hands well inside that window. Belgian patients have a second route to the same thing: the Patient Rights Act of 22 August 2002, substantially amended by the Act of 6 February 2024 and in force since 4 March 2024, strengthened comprehensible information, transparency and digital access to the file.
Practices are welcome to lift this section into their own privacy notice and link to this page from it, which is part of why it is written the way it is.
- Access to the recording, the transcript and the summary of a call.
- Rectification of anything recorded wrongly, including a misheard name or date.
- Erasure, within the limits the clinical and accounting retention rules set.
- Objection to the processing, which in practice means asking for a human line.
- A complaint to the Gegevensbeschermingsautoriteit / Autorité de protection des données, the Belgian data protection authority, at Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels. It costs nothing to file.
What does the EU AI Act require, and what does Tilcao not claim?
Article 50 of the EU AI Act has applied since 2 August 2026. It requires that a person be informed they are interacting with an AI system, unless that would be obvious to a reasonably well-informed, observant and circumspect person. It applies whether or not the system is high-risk, and national market surveillance authorities can enforce it from that date. Tilcao gives the disclosure whether or not it would be obvious, in the first sentence, before anything else is said.
An appointment-booking agent is not a high-risk AI system, and this page will not pretend otherwise in either direction. Tilcao has not done a high-risk conformity assessment, does not need one for this use, and claims no compliance status of any kind. Article 50 is not a certificate to display. It is something a system either does on every single call or does not do, and the way to check it is to ring the demo number and listen to the first sentence.
This is the opening line, in the three languages Tilcao answers in. A practice can change the wording to fit how it speaks to its patients. It cannot remove the disclosure.
- English: Hello, you have reached the dental practice. You are speaking to the practice’s AI assistant and this call is recorded. How can I help you today?
- Dutch: Goeiedag, u bent bij de tandartspraktijk. U spreekt met de AI-assistent van de praktijk en dit gesprek wordt opgenomen. Waarmee kan ik u helpen?
- French: Bonjour, vous êtes bien au cabinet dentaire. Vous parlez à l’assistant IA du cabinet et cet appel est enregistré. Que puis-je faire pour vous ?
| Not held, not claimed | What is true instead |
|---|---|
| ISO 27001 | Tilcao does not hold the certification and does not claim it |
| SOC 2 | No report exists. There is nothing to send you |
| NIS2 compliance status | No status is claimed under NIS2 |
| A completed DPIA | None has been completed. Where the practice needs one as controller, the assessment is the controller’s to make, and Tilcao supplies the detail it asks for |
| A high-risk conformity assessment under the AI Act | Not done, and not required for an appointment-booking agent |
| An eHealth certificate or a place on the MyCareNet list | Neither is held, and neither is needed to write an appointment into a diary |
| An endorsement from a Belgian professional body | There is no Order of Dentists in Belgium, and no association has published a position on AI at the front desk |
Questions practices ask
Is an AI receptionist GDPR compliant for a Belgian dental practice?
It can be, and compliance is an arrangement between the practice and the supplier rather than a property of the software. A dental call is special-category health data under Article 9 of the GDPR, so the practice processes it as controller on Article 9(2)(h) for the provision of health care, read with Article 6, and the supplier processes it as processor under a written Article 28 agreement. No vendor can be GDPR compliant on your behalf, and any vendor claiming to be should be asked to show you the agreement instead.
Do we need a verwerkersovereenkomst or contrat de sous-traitance with Tilcao?
Yes, and it has to be signed before the first real patient call rather than during the pilot. It is the Article 28 processing agreement, and it sets out the instructions Tilcao may act on, the retention period per data type as a number, the security measures, how a breach is notified, how access and erasure requests are handled, and what happens to the data at the end. Its annex names every sub-processor and the region it processes in, so the list can be checked rather than believed.
Are patient calls recorded, and do callers know?
Calls are recorded, and the caller is told in the opening sentence, together with the fact that they are speaking to an AI and how long the recording is kept. Belgian law does not forbid recording a conversation you are party to, but Article 314bis §2 of the Strafwetboek / Code pénal punishes using such a recording with intent to harm, and telecom rules and the GDPR both require the notice in advance. Any caller who would rather speak to a person says so and is handed over, because a disclosure with no alternative is not a choice.
Does a recorded call breach beroepsgeheim or secret professionnel?
Not if the people who can hear it are bound the way the practice is bound. Article 458 of the Strafwetboek / Code pénal applies independently of the GDPR, it is criminal rather than administrative, and no contract signs it away. Article 9(3) of the GDPR points at the same requirement: the processing has to happen under the responsibility of someone bound by professional secrecy or an equivalent duty. Inside Tilcao that means only the people who need a transcript can read one, each under a written confidentiality obligation mirroring medical secrecy, with every read logged against a named account.
Where is our patients’ data hosted?
In the EU and the EEA. No Belgian statute obliges a private dental practice to keep data inside Belgium, but EU and EEA processing is the expectation for Article 9 health data in a clinical setting and it is the commitment here. Rather than a blanket promise that a change of supplier would break, every sub-processor and the region it processes in is named in the annex to the processing agreement, and the list changes with a dated entry. Today the channels run on Retell for voice and the Meta Cloud API for WhatsApp.
How long are recordings and transcripts kept?
On a shorter clock than the clinical file, and on more than one clock. The raw audio is the first thing deleted, the transcript lives longer because it is what an access request is answered from, and the structured summary stays while the practice needs the operational record. This page prints no number because Tilcao is pre-pilot and the periods are agreed with each practice, but they are written into the agreement as days and months. A retention clause that says only “as long as necessary” is not a retention clause.
Can a patient ask us to delete a recorded call?
Yes, and the request goes to the practice, because the practice is the controller. The practice instructs Tilcao, and the audio, transcript and structured summary for that patient are deleted, while the audit trail keeps the fact of the deletion and not its content. Erasure does not reach records the law requires the practice to keep: the clinical dossier and the accounting trail sit in the practice’s own systems under their own retention rules.
Is Tilcao ISO 27001 or SOC 2 certified?
No. Tilcao holds no ISO 27001 certification, has no SOC 2 report, claims no NIS2 status, has not completed a data protection impact assessment and has not done a high-risk conformity assessment under the AI Act, which an appointment-booking agent does not require. It holds no eHealth certificate and is not on the MyCareNet approved-software list, neither of which is needed to write an appointment into a diary. Tilcao is early, and saying so is more useful than a badge that would not survive a question.
Who do we complain to if something goes wrong with our patients’ data?
The Belgian supervisory authority is the Gegevensbeschermingsautoriteit / Autorité de protection des données, at Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, and a complaint there costs nothing. The practice, as controller, is also the first address for a patient, which is why the processing agreement sets out how quickly Tilcao has to hand over what the practice needs to answer. A personal data breach has its own clock and its own notification route, and both belong in the agreement rather than in a support ticket.